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RKMARKS 

The Examiner rejected claims 3, 7 and 1 1 under 35 U.S.C. §112, second paragraph, as 
allegedly being indefinite for failing to particularly point out and distinctly claim the subject 
maltc which applicant regards as the invention. 

The Examiner rejected claims 4, 8 and 12 under 35 U.S.C. §112, second paragraph, as 
allegedly being indefinite for Tailing to particularly point out and distinctly claim the subject 
m alter wh i ch applicant regards as the in vention . 

The Examiner rejected claims 1-12 and 17 under 35 U.S.C. § 102(c) as allegedly being 
anticipated by US Publication No. 2002/01 1 2185 to Hodges. 

The lixaminer rejected claims 13-16 under 35 U.S.C, §1 03(a) as allegedly being 
unpatentable over Hodges (US Publication No. 2002/01 121 185) in view of US Patent No. 
6,167,520 to Touboul. 

The Examiner rejected claim 18 under 35 U.S.C. §103(a) as allegedly being unpatentable 
over Hodges (US Publication No. 2002/01 12185) in view of US Patent No. 5,51 9,717 to Lorenzo 
et al, 

The Examiner rejected claim 19-21 under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over Hodges (US Publication No. 2002/01 1 21 85) in view of US Patent No. 

6,351,752 to Cousins ct al. 

Applicants respectfully traverse the §1 12, § 102(e) and § 103(a) rejections with the 

following arguments. 
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y D.S.C. SI | 2 n Second Paragr aph 

The Examiner rejected claims 3, 7 and 1 1 under 35 U.S.C. §112, second paragraph, as 
allegedly "being indefinite for failing to particularly point out and distinctly claim the subject 
matte which applicant regards as the invention. Applicant mentions "network validity" on Line 1 
of Claims 3,7,1 1 respectively, this term is renders the claim indefinite, as this term is not easily 
understood by one with ordinary skill in the art. The examiner recommends "network descriptive 
validity" as mentioned in the specification. And the Claims 3,7, 1 1 have been treated as "network 
descriptive validity" as described in the specifications." 

Applicants note that claims 7 and 1 1 have been canceled. Therefore, the rejection of 
claims 7 and 1 1 under 35 U.S.C. §112, second paragraph is moot. 

Applicants respectfully contend that the Examiner is viewing the word "validity" in 
"network validity", as a noun in claim 3. Applicants respectfully contend that the preceding view 
of the Examiner is incorrect, because the Examiner has overlooked the word "condition" in the 
phrase "network validity condition" in claim 3. Applicants maintain that the word "condition" 
should not be severed from (he phrase "network validity condition" in interpreting the phrase 
"network validity condition" in claim 3. When interpreted as an integral phrase without being 
broken up, "network validity condition" is unambiguously described with examples in the 
specification on page 1, lines 13-16 which recites: "A validity condition that includes a network- 
descriptive specification is called a network validity condition. For example, a network validity 
condition maybe "operative during periods of light incoming network traffic," or "operative 
during periods of heavy loading," or "operative when both systems RALVM6 and RALVM8 are 
heavily loaded," and so forth" (emphasis added). 
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Accordingly, Applicants respectively request that the rejection of claim 3 under 35 U.S.C. 
§112, second paragraph be withdrawn. 



The Examiner rejected claims 4, 8 and 12 under 35 U.S.C. §11 2, second paragraphias 
allegedly "being indefinite for failing to particularly point out and distinctly claim the subject 
matter which applicant regards as the invention. Applicant mentions "compound validity' on Line 
1 of Claims 4,8,12 respectively, this term is not specified within the claim, as this term is not 
easily understood by one with ordinary skill in the art. The examiner recommends something 
similar to effect of "The validity conditions maybe compound or Boolean, and include multiple 
temporal specifications, or multiple network-descriptive specifications, or both temporal and 
nctwork-dcscriplivc specifications" as stated in the specification. And the Claims 4,8,12 have 
been treated as described in the specification. 

Applicants note that claims 8 and 1 2 have been canceled. Therefore, the rejection of 
claims 8 and 12 under 35 U.S.C. §112, second paragraph is moot. As to claim 4, Applicants 
have amended claim 4 as suggested by the Lixarnincr. 

Accordingly, Applicants respectively request that the rejection of claim 4 under 35 U.S.C. 

§112, second paragraph be withdrawn. 
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35 U.S.C . $102( cl 

The Examiner rejected claims 1-12 and 17 under 35 U.S.C. §102(e) as allegedly being 
anticipated by US Publication No. 2002/01 1 21 85 to Hodges. 

Applicants note that claims 5-8 and 1 0-12 have been canceled. Therefore, the rejection of 
claims 5-8 and 1 0-12 under 35 U.S.C. §1 02(e) is moot. 



Clai ms 1-4 

— t »■ — ■ * 

Applicants respectfully contend that Hodges docs not anticipate claim 1, because Hodges 
docs not leach each and every feature of claim 1 . 

A first reason why Hodges docs not anticipate claim 1 is that Hodges does not teach the 
feature: "awaiting an occurrence of a next update time of the intrusion detection system, said 
next update time being a time at which at least one validity condition of the at least one business 
role is checked". 

A second reason why Hodges docs not anticipate claim 1 is that Hodges does not teach 
the feature: "responsive to the occurrence of the next update time, checking the at least one 
validity condition o f the at least one business rule to determine whether a provision of any 
business rule of the at least one business rule is a newly operative provision that has first become 
operative or gone into effect since an occurrence of a last previous update time at which the at 
least one validity condition of the at least one business rule was checked, said newly operative 
provision prescribing an alteration of an intrusion set that the provision applies to". 

A third reason why Hodges does not anticipate claim 1 is that Hodges does not teach the 
feature: "if the checked provision is the newly operative provision that applies to the intrusion 
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set, then altering the intrusion set according to the newly operative provis.on . 

Based on the preceding arguments, Applicants respectfully maintain that Hodges docs not 
anticipate claim 1, and that claim 1 is in condition for allowance. Since claims 2-4 depend from 
claim 1, Applicants contend that claims 2-4 arc likewise in condition for allowance. 



■najr nB 9 an d 17 

Applicants respectfully contend that Hodges does not anticipate claim 9, because Hodges 
docs not teach each and every feature o f clai m 9 , 



A first reason why Hodges docs not anticipate claim 9 is that Hodges does not teach the 
feature: "awaiting an update time of the intrusion detection system The Examiner alleges that 
Hodges, Paragraph 0012, lines 3-6 teach the preceding feature of claim 9. In response, 
Applicants contend that Hodges, Paragraph 0012, lines 3-6 teaches that a "system detects an 
access system event in the access system and determines whether the access system event is of a 
type that is being monitored " Hodges, Paragraph 001 2, lines 3-6 most certainly does not teach 
awaiting an update time and most certainly docs not teach awaiting any type of time. 

A second reason why Hodges does not anticipate claim 9 is that Hodges does not teach 
the Feature: "responsive to occurrence of an update time, checking validity condition, of the set 
of business rules to determine whether a provision of any of the set of business rules is a newly 
operative provision". The Examiner alleges that Hodges, Paragraph 0102 (lines 18-25), 
Paragraph 0036, and Paragraph 0034 teach the preceding feature of cl aim 9. In response, 
Applicants contend that Hodges, Paragraph 01 02 (lines 18-25), Paragraph 0036, and Paragraph 



09/851,286 11 



PAGE 12120 • RCVD AT 311/2005 2:01:36 PM [Eastern Standard Time] « SVR:USPT0-EFXRMI1 ' DNIS:8729306 ' CS1D: * DURATION (mnws):04-28 



HAR-01-05 TUE 02:25 PM 



FAX NO. 



P. 



-0034 do not teach the preceding feature of claim 9. Paragraph 0102 (lines 18-25) leaches a 
"global sequence number ... updated in response to subsequent policy changes" which is not a 
teaching of "responsive to occurrence of an update time, checking validity conditions ..." as 
required by claim 9. Hodges, Paragraph 0036 and 0034 refer to FIGS. 19 and 17, respectively, 
and FIGS. 19 and 17 do not teach an action of any kind as being "responsive to occurrence of an 
update time". 

A third reason why Hodges does not anticipate claim 9 is that Hodges does not teach the 
feature: "for each newly operative provision, checking an intrusion set to determine whether the 
newly operative provision applies to the intrusion set". The Examiner alleges that Hodges, 
Paragraph 0102 (lines 1 8-25), Paragraph 0036, and Paragraph 0034 teach the preceding feature of 
claim 9. In response, Applicants contend that Hodges, Paragraph 01 02 (lines 18-25), Paragraph 
0036, and Paragraph 0034 do not teach the preceding feature of claim 9. Applicants respectfully 
request that the Examiner provide an analysis thai' explains how Hodges, Paragraph 0102 (lines 
1 8-25), Paragraph 0036, and Paragraph 0034 allegedly teach "for each newly operative provision, 
checking an intrusion set to determine whether the newly operative provision applies to the 
inunsion set". 

A fourth reason why Hodges does not anticipate claim 9 is that Hodges docs not teach the 
feature: "if the new provision applies to the intrusion set, altering the intrusion set according to 



the newly operative proviston". The Examiner alleges that Hodges, Paragraph 0102 (lines 18- 
25), Paragraph 0036, and Paragraph 0034 teach the preceding feature of claim 9. In response, 
Applicants contend that Hodges, Paragraph 0102 (lines 18-25), Paragraph 0036, and Paragraph 
0034 do not teach the preceding feature of claim 9. Applicants respectfully request that the 
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Examiner provide an analysis that explains how Hodges, Paragraph 0102 (lines 18-25), 
Paragraph 0036, and Paragraph 0034 allegedly teach "if the new provision applies to the 
intrusion set, altering the intrusion set according to the newly operative provision". 

Based on the preceding arguments, Applicants respectfully maintain that Hodges docs not 
nnticipate claim 9, and that claim 9 is in condition for allowance. Since claim 17 depends from 
claim 9, Applicants contend that claim 1 7 is likewise in condition for allowance. 
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Claim s 13-16 



unp 



The Exaraiuer rejected claims 13~16under35 U.S.C. §1 03(a) as allegedly being 
atcntablc over Hodges (US Publication No. 2002/01 121 1 85) in view of US Patent No. 



6,167,520 to Touboul. 

Since claims 13-16 depend from claim 9, which Applicants have argued supra to not be 
unpatentable over Jones under 35 U.S.C. §102(c), Applicants maintain that claims 13-16 arc 
likewise not unpatentable over Jones in view of Touboul under 35 U.S.C. § 103(a). 



It* addition, Applicants respectfully contend that Hodges in view of Touboul docs not 
teach or suggest the following feature of claim 13: "wherein the step of altering the intrusion set 
includes the step of altering a signature of the intrusion set". The Examiner argues that Touboul, 
col. 1 , lines 52-59 discloses the preceding feature of claim 1 3. In response, Applicants maintain 
that Touboul, col. 1, lines 52-59 discloses a digital signature registration stamp. Applicants 
further maintain that, irrespective of whether a digital signature registration stamp is a signature 
Of an intrusion step, Touboul, col. 1, lines 52-59 most certainly docs teach or suggest altering the 
digital signature registration stamp. 



In addition, Applicants respectfully contend that Hodges in view of Touboul docs not 
teach or suggest the following feature of claim 14: "wherein the step of altering the intrusion set 
includes the step of altering a threshold of the intrusion set". The Examiner argues that Touboul, 
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col. 4, lines 51-55 discloses the preceding feature of claim 14. In response, Applicants maintain 
that Touboul, col. 4, lines 5 1 -55 does not disclose altering a threshold of the intrusion set. In 
fact, Touboul, col. 4, lines 51-55 does not disclose altering anything. 



In addition, Applicants respectfully contend that Hodges in view of Touboul does not 
leach or suggest the following feature of claim 15: "wherein the step of altering the intrusion set 
includes the step of altering an action of the intrusion set". The Examiner argues that Touboul, 
col. 4, lines 60-61 discloses the preceding feature of claim 1 5. In response, Applicants maintain 
that Touboul, col. 4, lines 60-61 discloses stopping an applet. However, Applicants maintain the 
applet, which may be an action, is not an action of an intrusion set. 



I 



a addition, Applicants respectfully contend that Hodges in view of Touboul docs not 



teach or suggest the following feature of claim 1 6: "wherein the step of altering the intrusion set 
includes the step of altering a weight of the intrusion set". The Examiner argues that Touboul, 
col. 4, lines 60-61 discloses the preceding feature of claim 16. In response, Applicants maintain 
that Touboul, col. 4, lines 60-61 discloses stopping an applet. However, Applicants maintain the 
applet is not a weight, and is most certainly not a weight of an intrusion set. 



Accordingly, Applicants maintain that claims 13-16 are not unpatentable over Jones in 
view of Touboul under 35 U.S.C. §103(a). 
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Claim 18 

The Examiner rejected claim 18 under 35 U.S.C. § 103(a) as allegedly being unpatentable 
Hodges (US Publication No. 2002/0112185) in view of US Patent No. 5,519,717 to Lorenzo 



over 



et al. 

S ince claim 1 8 depends from claim 9, which Applicants have argued supra to not be 
unpatentable over Hodges under 35 U.S.C. §1 02(b), Applicants maintain that claim 1 8 is 
likewise not unpatentable over Jones in view of Lorenzo under 35 U.S.C. §103(a). 



Tn addition, Applicants respectfully contend that Hodges in view of Lorenzo docs not 
teach or suggest the following feature of claim 18: "wherein the update time is one of a plurality 
of update times that occur substantially periodically". 

The Examiner argues lhat T^orcnzo, col. 3, lines 60-66 discloses the preceding feature of 
claim 18 and that "U]t would be obvious to one having ordinary skill in the art at the lime of the 
invention to include update time being plurality of update times being periodic in order to 

provide for synchronization with the network 

In response, Applicants maintain that Loren/o, col. 3, lines 60-66 discloses that "the 
remote units can periodically adjust their local clocks so that the synchronization update time of 
their local clock is in-line or synchronous with the synchronization update time of the network 
clock", Thus, if one were to update the local clocks to be in-line or synchronous with the 
synchronization update time of Ac network clock, then one could not alter the update time of the 
clocks according to the newly operative provision of the set of business rules as required by 
claim 1 8. Accordingly, the Examiner's reason for modifying Hodges by the alleged teaching of 
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Lorenzo is inconsistent with the aforementioned requirement of claim 1 8. 

Accordingly, Applicants maintain that claim 1 8 is not unpatentable over Jones in view of 

Lorenzo under 35 U.S.C. §l03(a). 



Claims 1 9^21 

The Examiner rejected claim 19-21 under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over Hodges (US Publication No. 2002/01 12185) in view of US Patent No. 

6,351,752 to Cousins el al. 

Since claims 19 and 20-21 depend from claims 9 and 1, respectively, which Applicants 
have argued supra la not be unpatentable over Jones under 35 U.S.C § 102(c), Applicants 
maintain dial claims 19-21 arc likewise not unpatentable over Jones in view of Cousins under 35 



U.S.C. §1 03(a). 



In addUioa, Applicants respectfully contend that Hodges in view of Ix>rcnzo docs not 
teach or suggest the following feature of claim 19: "wherein the update time is a computed 

update time"* 

The Examiner argues: "Regarding Claim 19, Hodges docs not disclose update time being 



an com 



putcd update time. However, Cousins ct al . discloses update time being an computed 
update time see Column 7 Line 5-12. It would be obvious to one having ordinary skill in the art 
at the time of the invention to inelude update time being an computed update time in order for all 
the rules to have an combined time sec Column 5 Line 36-44." 

In response, Applicants respectfully contend that the preceding argument by the Examiner 
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does not make any sense. First, The phrase "a combined time" is ambiguous and Applicants 
request that the Examiner explain what the preceding phrase means. Second, having an updated 
time be a computed update time merely means that one computes the update time, which does 

not imply a "combined time". 

Accordingly, Applicants maintain that claim 19 is not unpatentable over Jones in view of 

Cousins under 35 U.S.C. §103(a). 
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CONCLUSION 



Based on tbc preceding arguments, Applicants respectfully believe that all pending claims 
and the entire application meet Ihc acceptance criteria for allowance and therefore request 
favorable action. If the Examiner believes that anything further would be helpful to place the 
application in better condition for allowance, Applicants invites the Examiner to contact 
Applicants' representative at the telephone number listed below. The Director is hereby 
authorized to charge and/or credit Deposit Account No. 09-0457. 



, Jack P. Friedman 

Registration No. 44,688 

Schmeiscr, Olsen & Watts 
3 Lear J el Lane, Suite 201 
Latham, New York 12110 

(5 IS) 220-1850 
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